Declares an option for select and radio group elements. Child element of these input elements.

<splunk-text-area>

Resizable text area.

<splunk-text-input>

Text input.

<splunk-color-picker>

Color picker element with three preconfigured palette types. Also allows a custom palette.

<splunk-color>

Declares a color value for a custom color picker palette. Child element of the <splunk-color-picker> element.

These elements have styling consistent with standard Splunk Web elements, although they do not have the standard Splunk Web layout by default.

Wrapper for input elements and labels

Wrap all format menu input elements with this component.

<splunk-control-group>

You can specify the following <splunk-control-group> attributes.

Attribute

Description

label

Label for the input element. Appears in the UI.

help

String appearing underneath the control.

Selection elements

The following elements present options and a selection interface to users.

splunk-select

Use the <splunk-select> element to create a selection control. Options appear in a list.

Specify one or more <option> child elements defining available options. In this example, there are six email priority level options.

splunk-radio-input

Use the <splunk-radio-input> element to declare a radio group control.

Requirements
Specify one or more <option> child elements to indicate the options that appear as radio buttons.

option

Use an <option> child element with a <splunk-select> or <splunk-radio-input> to specify available options. The <option> enclosed text appears as the option label. When a user selects an option, the <option> value is set as the control value.

splunk-color-picker

Use this element to provide a color configuration user interface.

Specify one of the following color palette types for the color picker.

splunkCategorical. Default type if none is specified.

splunkSemantic

splunkSequential

custom

Specify colors in the custom palette or extend one of the available palette types using <splunk-color> tags.

Predefined color palettes are available as part of the custom alert action and custom visualization APIs. To learn more about the predefined color palette types, see Color in the Design guidelines for custom visualizations.

Text entry elements

The following elements let users add custom text.

splunk-text-input

Use a <splunk-text-input> element to create a text input control. Users can enter up to a single line of text in a splunk-text-input control.

splunk-text-area

Use a <splunk-text-area> element to create a text area control. Users can enter multiple lines of text in a <splunk-text-area> control.

Dynamic input controls

Search to populate the input
Consider the following details when writing a search to generate custom input options.

In addition to provided platform commands and resources, you can use a custom search command and/or query a custom endpoint.

For better performance, use a search that generates only the results that you need to populate the input. You can also consider commands to minimize processing.

The search runs in the context of the current user and the deployment where the custom alert action is installed. When constructing the search, consider how dynamically populated options might vary depending on the resources available to the user and in the deployment.

Dynamic input control attributes

Use the following attributes to build a dynamically populated input dropdown.

Name

Description

Default

Required?

name

Input name. This name should match the setting name in savedsearches.conf to ensure that user configurations propagate from the input to the configuration file.

N/A

Yes

search

The query string to execute. Query the REST API, a lookup table, or indexed data.

N/A

Yes

label-field

Field name to use for dropdown option labels. Labels generated from this field are visible in the dropdown interface.

N/A

Yes

value-field

Field name to use for dropdown option values that correspond to the option labels.

In some cases, you can use the same results field for the label-field and value-field. In other cases, you might need to display human-readable labels from one field and use the corresponding values from another field. For example, an input might include a user_name field for the label-field and a user_id field for the value-field.

N/A

Yes

earliest

earliest_time in the search time range

" "

No

latest

latest_time in the search time range

"now"

No

app

App context in which the query runs. This specification can be useful when the search requires knowledge objects that are only available in a specific app context.

Defaults to the current app context.

No

allow-custom-value

Indicate whether to provide a field for the user to enter a custom value. Disabled by default. Developers can implement validation for user entered values.

false

No

max-results

Specify the maximum number of search results returned. Use any positive integer greater than 0.

1000

No

Note: Static or predefined options cannot be included in a dynamic dropdown input.

Syntax and examples

The following examples use queries against different resources to generate dropdown field labels and values.

REST API

Use the rest search command to populate the input. You can query available splunkd endpoints or
a custom endpoint.

Comments

Hi MisteRious,
Thank you for leaving a comment and submitting feedback. We're currently looking into the lost functionality. I urge you to lodge a support ticket. Please respond to my email if you have any problems doing so, and I'll further assist you.

Is it possible to d a multiselect based on the values returned by a splunk query? In our custom alert action, we need the user to be able to select multiple values from the dropdown (or potentially select all). However, from the above documentation it seems that only single select dropdowns are supported for dynamic input controls?

Ewagh splunk

July 2, 2018

Hi SK8,
Thanks for taking the time to leave your comment. You cannot use JavaScript in the custom alert UI. You can only use it to create the custom alert action itself.

Cheers,
Eve

Emeelan splunk, Splunker

June 6, 2018

It is possible to use javascript in the cutsom alert ui?

SK8

June 1, 2018

In regard to the previous two posts, when you create a custom alert that depends on building an app, you must set the permissions for the alert, which is a knowledge object. In order to do this, you must add a default.meta definition to your alert. Dbabanov's solution is very close to correct, the only change I would make would be to not specify the app in the alert_actions brackets ( [alert_actions]), in order to ensure that all alerts are globally accessible. There is a very handy blog post that describes this particular use case, and it can be found here: https://www.splunk.com/blog/2016/08/22/how-to-create-a-modular-alert.html
Thanks to both of you!

There seems to be something missing from this documentation. Even if I copy the webhook alert app and change the name across all files, the custom alert shows up BUT the input fields defined in the HTML do not show up. Is there somewhere other than the app itself that the configurations need to be put in for the custom HTML to work?

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »